We have just taken over managing an SBS2011 server and have a problem with C:\ free disk space disappearing for 30-60 minutes every day at ~19:00. I know about this because of Exchange complaining in the network report that there's low disk space so it is going to stop delivering email.

So, I setup a PowerShell script to record free disk space every 10 minutes:

Date

Time

C:\ Freespace

09/02/2017

-18:50

-29.72

09/02/2017

-19:00

-29.73

09/02/2017

-19:14

-14.77

09/02/2017

-19:24

-7.02

09/02/2017

-19:34

-2.47

09/02/2017

-19:44

-0.15

09/02/2017

-19:52

-29.13

You can see between 19:00 and 19:14 the space starts dropping and it eventually hits 0 GB free, before instantly jumping back to the usual free space.

I haven't yet been able to be on the server at the time it happens and I have looked at the event logs and nothing stands out as the cause. Also I checked the task scheduler and nothing which can cause the problem runs at 19:00.

I'm thinking maybe record processes writing to disk over the period 18:30-19:30 so I can view what is being very heavy handed. Though I haven't setup a monitor like this before, I have seen perfmon, but I haven't seen it with the list of processes just the overall write?

Is there something I can setup to be way more specific at monitoring disk activity?

Thanks everyone, found it was a piece of software (Sage) which when it backs up copies a whole load of data to "C:\Windows\temp" does its backup and,
if it was successful,
deletes the data when it's finished .

Sage does not show in the event logs and nor is it in the scheduled tasks, go figure...